Gzip Compressed Data
| Format | Gzip Compressed Data |
|---|---|
| Short name | gzip |
| Category | archive |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (GzipVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Single-file lossless compression format using DEFLATE (RFC 1951), defined in RFC 1952. Identified by magic bytes 0x1F 0x8B at offset 0. 10-byte header contains: compression method (CM=8 for DEFLATE), flags (FNAME, FCOMMENT, FEXTRA, FHCRC), mtime (4-byte Unix timestamp of original file — forensically significant, may reveal when the source file was last modified; 0 if unavailable, e.g. when a stream was compressed or the name/time were suppressed), OS byte (identifies the OS that created the file: 0=FAT, 3=Unix, 7=Mac, 11=NTFS), and optional original filename (FNAME flag). 8-byte footer: CRC-32 of uncompressed data and original file size (modulo 2^32). Forensically common as: Linux log rotation (.gz), compressed kernels and ramdisks in Android boot images (mainly older devices), iOS/macOS sysdiagnose archives (.tar.gz), network traffic content encoding, and database backups. Multiple gzip members can be concatenated in a single .gz file. OS byte and mtime can reveal the origin platform and source file age.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 1F 8B 08 | ... | Gzip magic number (ID1=0x1F, ID2=0x8B) and compression method 8 (DEFLATE) |
Known extensions
.gz, .tgz
References
- GZIP file format specification (RFC 1952) https://www.rfc-editor.org/rfc/rfc1952.html
- Gzip format overview (Wikipedia) https://en.wikipedia.org/wiki/Gzip
- Gzip format (Library of Congress) https://www.loc.gov/preservation/digital/formats/fdd/fdd000599.shtml
- Gzip (ForensicsWiki) https://forensics.wiki/gzip/
Cite this entry
Crush Format Reference, “Gzip Compressed Data”. https://kalink0.github.io/crush-forensics/formats/gzip/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction